linux-kernel - [PATCH][BUG] Incorrect SCSI transfer length computation from odd sized scsi_execute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Jul 2007 19:38:56 -0500
From:	Jeremy Linton <jli@...shamstorage.com>
To:	James Bottomley <James.Bottomley@...elEye.com>,
	Linux Scsi <linux-scsi@...r.kernel.org>,
	Linux Kernel List <linux-kernel@...r.kernel.org>
Subject: [PATCH][BUG] Incorrect SCSI transfer length computation from odd
 sized scsi_execute_async() transfers.

Any function which use scsi_execute_async() and transfers "odd" sized 
data that doesn't align correctly with the segment sizes may have its 
transfer length padded out to the closest segment size.

For writes, this results in unnecessary data being transfered to the 
SCSI target. For reads, it affects the residual data length being 
returned to the application since the residual length will be based on 
the padded transfer size rather than the actual request size.

The easiest way to see this is by trying to read using the SG_IO ioctl a 
large (>32k) buffer size from a tape device that only has a few bytes of 
data stored for the current block. The resulting resid will generally be 
incorrect.

I've fixed this simply by changing scsi_req_map_sg() so that it places 
the requested transfer length in rq->data_len rather than the sum of all 
the sg segments.

This patch applies against scsi_lib.c in 2.6.22.

Signed-off-by: Jeremy Linton <jli@...shamstorage.com>

--- linux-2.6.22/drivers/scsi/scsi_lib.c.orig   2007-07-11 
19:07:06.000000000 -0500
+++ linux-2.6.22/drivers/scsi/scsi_lib.c        2007-07-11 
18:43:36.000000000 -0500
@@ -350,7 +350,7 @@ static int scsi_req_map_sg(struct reques
         }

         rq->buffer = rq->data = NULL;
-       rq->data_len = data_len;
+       rq->data_len = bufflen;
         return 0;

  free_bios:

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/